snp(4) [linux man page]

SNP(4)                                                     BSD Kernel Interfaces Manual                                                     SNP(4)

NAME

     snp -- tty snoop interface

SYNOPSIS

     #include <sys/snoop.h>

     int
     ioctl(fd, SNPSTTY, &dev);

     int
     ioctl(fd, SNPGTTY, &dev);

     int
     ioctl(fd, FIONREAD, &result);

DESCRIPTION

     /dev/snp is a snoop device which allows users to attach to any tty and watch activities on it.  The kernel must be compiled with device snp,
     or the snp module must be loaded, for these devices to be available.

     To associate a given snp device with a tty to be observed, open the snp device and a tty device, and then issue the SNPSTTY ioctl on snp
     device.  The argument passed to the ioctl(2) is the address of a variable of type int, holding the file descriptor of a tty device.  To
     detach the snp device from a tty use a pointer to a value of -1.

     The SNPGTTY ioctl returns information about the current tty attached to the open snp device.

     The FIONREAD ioctl returns a positive value equal to the number of characters in a read buffer.  Special values defined are:

     SNP_OFLOW     device overflow occurred, device detached.

     SNP_TTYCLOSE  tty not attached.

     SNP_DETACH    snp device has been detached by user or tty device has been closed and detached.

SEE ALSO

     pty(4), sio(4), kldload(8), watch(8)

HISTORY

     The snp device first appeared in FreeBSD 2.1.  In FreeBSD 8.0 the snp driver was rewritten to work with the replaced TTY subsystem.

AUTHORS

     The author of the current implementation is Ed Schouten <ed@FreeBSD.org>.  Previous versions of snp were based on code written by
     Ugen J.S. Antsilevich <ugen@NetVision.net.il>.

BUGS

     This version of snp does not return proper error codes when calling FIONREAD.  It also does not allow SNPSTTY to detach itself from the TTY.

BSD                                                              November 5, 2008                                                              BSD

TTYSNOOP(8)                                                 BSD System Manager's Manual                                                TTYSNOOP(8)

NAME

     ttysnoop -- snoop on a user's tty

SYNOPSIS

     ttysnoop [pty]
     ttysnoops

DESCRIPTION

     The ttysnoop / ttysnoops client-server combo can be used to snoop (watch) on a user's login tty.  The server (ttysnoops) is usually started
     by getty(8) or telnetd(8) and reads the file /etc/snooptab to find out which tty's should be cloned and which programs to run on them (usu-
     ally /bin/login). A tty may be snooped through a pre-determined (ie.  fixed) device, or through a dynamically allocated pseudo-tty (pty).
     This is also specified in the /etc/snooptab file. To connect to the pty, the client ttysnoop should be used. The available pseudo terminals
     pty are present as sockets in the directory /var/spool/ttysnoop/.

   Format of /etc/snooptab
     The /etc/snooptab file may contain comment lines (starting with a '#'), empty lines, or entries for tty's that should be snooped upon. The
     format of such an entry is as follows:

           tty   snoop-device   type   program

     where tty is the leaf-name of the tty that should be snooped upon (eg. ttyS2, not /dev/ttyS2) OR the wildcard '*', which matches ANY tty.
     snoop-device is the device through which tty should be snooped (eg. /dev/tty8) OR the literal constant "socket". The latter is used to tell
     ttysnoops that the snoop-device will be a dynamically allocated pty.  type specifies the type of program that should be run, currently recog-
     nized types are "init", "user" and "login" although the former two aren't really needed. Finally, program is the full pathname to the program
     to run when ttysnoops has cloned tty onto snoop-device.

EXAMPLE

     The following example /etc/snooptab file should illustrate the typical use of ttysnoop / ttysnoops:

            #
            # example /etc/snooptab
            #
            ttyS0    /dev/tty7    login    /bin/login
            ttyS1    /dev/tty8    login    /bin/login
            #
            # the wildcard tty should always be the last one in the file
            #
            *        socket       login    /bin/login
            #
            # example end
            #

     With the above example, whenever a user logs in on /dev/ttyS0 or /dev/ttyS1, either tty will be snooped through /dev/tty7 or /dev/tty8
     respectively. Any other tty's will be snooped through a pty that will be allocated at the time of login. The system-administrator can then
     run ttysnoop pty to snoop through the pty. Note that it is up to the system-administrator to setup getty and/or telnetd so that they execute
     ttysnoops instead of /bin/login.

SEE ALSO

     getty(8), telnetd(8)

FILES

     /etc/snooptab

BUGS

     The program is unable to do any terminal control-code translations for the original tty and the snoop-device. I doubt it will ever do this.

AUTHOR

     Carl Declerck, carl@miskatonic.inbe.net

BSD                                                                August 8 1994                                                               BSD